Which ports does NMAP scan for OS-detection

Question

nmap offers OS-detection functionality based TCP/IP fingerprinting by sending six probing packets and analyzing their responses. In the documentation is says that some of them are send to an open port and some are sent to a closed port.

Does anyone know how nmap decides which port to send the probes to? Does it just look for the first closed port and the first open ports it can find? Does it search for them in a certain order? Or does it randomly pick a port?

This link can help you.: [nmap documentations](https://nmap.org/man/it/man-os-detection.html) — Fabrizio Restori, Jan 27 '17 at 15:23
Thanks for your help. But that link basically mentions the same as the documentation I already found. — arne.z, Jan 27 '17 at 15:34

score 1 · Accepted Answer · answered Jan 27 '17 at 16:29

In this case, there is no better documentation than the code itself. Nmap relies on port scan results to determine a list of open and closed ports. It is looking for three things in particular:

an open TCP port
a closed TCP port
a closed UDP port

Generally speaking, it chooses the first of these (lowest number) that it knows of, but there are a couple of rules for things that it tries to avoid:

Do not use port 0. For most systems, this is not a valid port number. The chance is pretty high that if port 0 is found open, the thing using it to communicate is not the OS's native IP stack.
If service scan was performed, avoid ports that were labeled tcpwrapped. This can sometimes be a result of an IPS shutting down a connection, so skipping these ports helps assure that Nmap is getting an unmodified connection to the target.

score 1 · Answer 2 · answered Jan 27 '17 at 16:35

If I well understood, nmap tries open or closed ports only if isn't able to detect the OS via fingerprint, but the documentations doesn't explain the sequence of checked ports. I think you could discover how, tracking your own traffic during the scan.

Which ports does NMAP scan for OS-detection

2 Answers2